[Invalid] Disabling webgl causes github.com to hang

[barbaz]

NoScript 11.5.0rc1
Firefox 132.0
new profile

STR:

1) NoScript Options > General > Trusted, un-check "webgl"

2) NoScript Options > Per-site Permissions, set github.com and githubassets.com Trusted

3) visit https://github.com/

In a clean profile, this results in the site hanging and high CPU usage. I can close the browser with the X on the window.

In my main profile, the hang is more severe. I eventually get a slow script banner pointing to NoScript. The hang continues regardless of selecting "Stop script" or "Debug": the only way to quit the browser is with Ctrl+C at the terminal.

[fatboy]

Fx 115.15.0esr
Same thing, but I can close a tab.

[Giorgio Maone]

This is not new in 1.5, neither NoScript specific.

If you disable NoScript and set the webgl.disabled about:config preference to false, you will cause the same endless tight loop from the github script stubbornly trying to instantiate a webgl context and repeatedly failing. In this case the slowdown will be correctly attributed to github.com.

I'm gonna check if NoScript can do anything to mitigate this bug, which on the other hand is arguably Gighub's fault.

[barbaz]

Thanks Giorgio for investigating. Can NoScript reasonably avoid being erroneously blamed in slow script warnings like this?

I'm gonna check if NoScript can do anything to mitigate this bug,

One possible line of thinking:

Didn't previous NoScript Webext versions take a different approach to presenting blocked WebGL to the page, which had a very different effect on web-compat (e.g. viewtopic.php?t=25596 - and IIRC there were numerous other examples of it differing from more standard WebGL blocking, some where it was better & some where it was worse)

Looking at the changelog I tried NoScript 11.1.9rc4 as a test, thinking that might have been the last version to use the "original" presentation of blocked WebGL (is it?) 11.1.9rc4 doesn't prevent the issue, but the slow script warning pointed to the page, and I didn't need to resort to Ctrl+C to quit the browser. And with 11.1.9rc4 the Browser Console is spammed with "permission denied" errors (sorry couldn't copy+paste), whereas the error messages from 11.5.0rc1 are much more generic like "Error creating WebGL context".

IIRC there was fairly strong reason not to globally use the "original" presentation of blocked WebGL, and fairly strong reason why the current presentation of blocked WebGL is generally preferred. But might opting into the "original" blocked WebGL presentation (or something closer to it) on a per-site basis lead to a workaround here?

[Giorgio Maone]

Please check RC3 or above:

v 11.5.1rc3
============================================================
x [nscl] Panic abort on buggy pages (like
https://github.com/) going in infinite loops when webgl is
disabled
x Refactoring to use DocRewriter

[fatboy]

rc4, github
On a clean profile: when clicking on a placeholder, the webgl resolution window does not always appear. When clicking again, the page hangs. The tab cannot be closed, only the browser.

On the main profile (all other extensions are disabled): when clicking on a placeholder, the webgl resolution window appears for a split second and immediately disappears.
The message is repeated in the console:

Code: Select all

nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)"  location: "JS frame :: resource://gre/modules/ExtensionCommon.sys.mjs :: runSafeSyncWithoutClone :: line 64"  data: no] ExtensionCommon.sys.mjs:64:12

[barbaz]

NoScript 11.5.1rc4 completely solves this issue for me. Thanks Giorgio!

[Giorgio Maone]

The message is repeated in the console:

Code: Select all

nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)"  location: "JS frame :: resource://gre/modules/ExtensionCommon.sys.mjs :: runSafeSyncWithoutClone :: line 64"  data: no] ExtensionCommon.sys.mjs:64:12

I've managed to reproduce and possibly fix it. Please check 11.5.2rc1, thanks.

[fatboy]

11.5.2rc1
No hang-ups.
But now additional windows open.
https://cloud.disroot.org/s/rpw2Y5pyPdSDLBk - console, images (you can watch there) and video (only download).

UPD:"Cross-tab identity leak protection" windows — https://m.freespeech.club//q61TPm5D.png

UPD2: Fx 115.18.0esr, NS 11.5.3rc2, the additional window keeps "winking".

Code: Select all

10:32:19.970 Promise rejected after context unloaded: Actor 'Conduits' destroyed before query 'RuntimeMessage' was resolved
2 Messages.js:127
    _send moz-extension://dcb8a0a3-ea56-41ef-98e5-0e15c59d4abf/nscl/common/Messages.js:127

10:32:42.206 sendRemoveListener on closed conduit {73a6fe31-595d-460b-a920-fcc0f8843232}.137438956382 ConduitsChild.sys.mjs:108
    _send resource://gre/modules/ConduitsChild.sys.mjs:108
    removeListener resource://gre/modules/ExtensionChild.sys.mjs:675
    removeListener resource://gre/modules/ExtensionChild.sys.mjs:940
    register chrome://extensions/content/child/ext-storage.js:175
    removeListener resource://gre/modules/ExtensionCommon.sys.mjs:2869
    revoke resource://gre/modules/ExtensionCommon.sys.mjs:2891
    close resource://gre/modules/ExtensionCommon.sys.mjs:2896
    unload resource://gre/modules/ExtensionCommon.sys.mjs:979
    unload resource://gre/modules/ExtensionPageChild.sys.mjs:282
    unload resource://gre/modules/ExtensionPageChild.sys.mjs:319
    destroyExtensionContext resource://gre/modules/ExtensionPageChild.sys.mjs:479
    observe resource://gre/modules/ExtensionPageChild.sys.mjs:388